Posts

data breach compensation

Who can make a data breach claim?

Data breach claims are on the rise, not least because more and more organisations are using our sensitive personal data without investing in the necessary security measures to keep it safe.

At Hayes Connor Solicitors, our data breach lawyers are committed to upholding the rights of consumers across the UK. And, as part of this responsibility, we aim to ensure that as many people as possible understand their rights when it comes to this evolving and often complicated area of law.

So, in the UK, who can make a data breach claim?

Anyone who has suffered damage or distress caused by an organisation breaching any part of the Data Protection Act (the UK’s interpretation of the GDPR), has the right to claim compensation following a data breach. Both individuals and companies can make a data breach claim for compensation.

But, to claim compensation you must be able to prove that you suffered as a result of the data protection breach. And you can claim for both damages and distress.

Until recently, while a person who suffered damage might have had their compensation increased to take into account any associated distress, in most cases compensation would not have been awarded for distress alone. The only exception to this is where information had been used for journalistic, artistic, or literary purposes. However, this is no longer the case.

Today, you can make a data breach claim for distress even if you have not lost out financially.

How should you start your data breach claim?

If you think that a company is not looking after your data as well as it should, you can make a subject access request. You can make a subject access request at any time. For example, many of our clients make subject access requests to start the compensation claim process following a data breach. Find out more about how to make a subject access request here.

You should also ask the ICO to assess an organisation if you think it is guilty of a breach. If you want to contact the ICO you can do this here.

If the ICO thinks that an organisation has not complied with its obligations, it can give advice and ask it to solve the problem. The ICO’s main aim is to improve the information rights practices of organisations, where there is an opportunity to do so. However, the ICO will not usually investigate concerns where there has been an undue delay in bringing it to its attention. So, you should raise your concerns with the ICO within three months of your last meaningful contact with the organisation concerned (when you discovered the data breach).

However, it’s important to understand that, while the ICO does have the power to impose hefty fines on organisations in breach of their duties, it does not award compensation. But if the ICO thinks that an organisation is guilty of a breach, you can then use this information to support a data protection compensation claim.

Appointing an expert data protection solicitor

If you have contacted the ICO about a potential breach, Hayes Connor Solicitors can start to investigate your claim. We will work with the ICO to gather as much evidence as possible to help our clients succeed. In some cases, we can start a data breach claim without you having first registered your concerns with the ICO, but we always recommend this as a first step.

If you want to find out more about claiming for a data breach you can contact us here.

takeover fraud

Bank customer loses thousands of pounds in takeover fraud

In the latest example of takeover fraud, a customer of the Royal Bank of Scotland (RBS) had more than £4,300 stolen from her account despite the fraudulent caller answering one of her security questions incorrectly.

What is takeover fraud?

Takeover fraud happens when a criminal uses another person’s account information (e.g. a credit card number) to buy products and services. Takeover fraud is also used by scammers to extract funds from a person’s bank account.

With more than 24,000 reported cases, takeover fraud increased by 7% last year with bank accounts the most popular target.[1]

What happened in this case?

According to a report by BBC Watchdog Live, the bank maintained that the customer was aware of the transaction and refused to refund her. To make matters worse, the Financial Ombudsman Service – which helps to sort out disputes between financial businesses and their customers – backed RBS after the initial complaint.

However, following a BBC investigation, was revealed that in a recording of the fraudulent phone conversation, a woman can be heard incorrectly answering a security question.

What’s more, a second transaction request made during the same phone call was refused after the caller was unable to answer additional security questions. This eventually led to a warning being raised against the account. The bank’s records also show that the fraudster failed the bank’s voice recognition checks and that the transaction was marked as a “potential account takeover”.

Despite this, a transaction of £4,318 was approved by the bank in a decision which it refused to reverse.

RBS has now apologised to the woman and issued her a full refund. However, it is unclear whether this would have happened without the Watchdog Live investigation.

Worryingly, the bank failed to consider the evidence in this case, including warnings raised by its security processes.

A new code of conduct

Since the con took place, most banks have signed up to a new code of conduct which provides an additional layer of protection to customer affected by bank scams. The new code is designed to minimise the number of financial cybercrimes by encouraging consumers to remain vigilant.

In essence, the new code means that a bank (or another financial provider) can only refuse to reimburse stolen funds where the customer has shown a very significant degree of carelessness. In this case, as the bank failed to heed the warning signs and the woman was in no way negligent, RBS would be liable for the subsequent loss.

Furthermore, under the new guidelines banks should not automatically blame the victims of increasingly sophisticated scams and must take a fairer approach to compensation. What this means is that you can be confident that any claim for reimbursement will be given fairer and quicker consideration.

The code is expected to be finalised next year.

Cybercriminals are becoming increasingly sophisticated

Online criminals are becoming increasingly sophisticated. And it’s not just lone hackers people should worry about. Today, cybercrime syndicates are evolving from existing criminal structures. And, as they strive to become as rich as possible, these criminals are sharing information and collaborating.

As such, banks must make sure that their processes are just as sophisticated and robust.

In this case, it was revealed that the woman’s phone line was diverted to a mobile number on the day of the call. This led to the bank to believe that they were speaking to her at her home address. However, if all the other security checks and processes had worked, the woman would not have been left without her funds for over a year.

Can you get help for takeover fraud?

If you have been the victim of a takeover scam and need help getting your money back, there is some good news.

As well as setting out a new industry code designed to minimise the number of scams by encouraging consumers to remain vigilant, the new industry protections will help victims to secure compensation.

If you need legal help following a takeover scam, Hayes Connor can help. Our professional, friendly team will be pleased to answer any questions you might have, and advise you on what to do next.

[1] Cifas

data breach claims

What is no-win, no-fee?

Access to professional legal advice is a fundamental right. That’s why it’s important that everyone can afford to make a data breach or cybercrime compensation claim should they need to.

Removing the financial risk, at Hayes Connor Solicitors, we provide our services on a no-win, no-fee basis to help our clients get the compensation they deserve. But what does this actually mean and are there really no costs if you appoint us?

What is no-win, no-fee?

A no win, no fee agreement is an arrangement between you and your solicitor. Also known as a Conditional Fee Agreement (CFA), if your claim is not successful, you won’t have to pay any money for the work carried out (as long as you adhere to the terms of our agreement).

No win, no fee agreements help people get the compensation they need following an incident that wasn’t their fault.

What if your claim is successful?

If your claim is successful (and that’s what we all want!), you might have to make a contribution to your solicitor’s costs. This ‘success fee’ is taken from the compensation awarded to you. The amount of the success fee depends on when your case is settled, but with us you’ll never have to pay more than 25% of your compensation. However in some cases, we are able to recover this cost from the other party. In such cases you won’t have to pay any costs – win or lose.

Your obligations under a no-win, no-fee agreement

You do have obligations under a CFA:

  • You must not mislead your solicitor
  • You must not fail to co-operate
  • You must act in accordance with the agreement and the advice given by your solicitor
  • Should you wish to terminate your claim, you will be responsible for all costs and disbursements incurred by your solicitor.

Can you afford the risk?

Well yes. Because if you lose you won’t have to pay a penny!

In most cases, the loser has to pay the winner’s costs and disbursements (other legal expenses such as court fees). But to protect you from these costs, we always take out insurance to insure against this risk on your behalf. This is called ‘After the Event’ insurance (ATE).

With ATE insurance, if you lose your case (including a group action case), any costs will be paid by the insurance provider. This means that if your claim is not successful, you won’t have to pay a penny.

MAKING A NO WIN, NO FEE CLAIM WITH HAYES CONNOR SOLICITORS

From the very first time you speak to us, you’ll find us helpful, friendly, and experienced. While each case is different, we can usually tell you straight away if you have a claim or not. Once you have confirmed that you want to proceed on a no-win no-fee basis, we’ll remove the hassle and take care of all the complex legal work for you. We always make sure you are fully informed about any potential costs before we proceed.

TO FIND OUT MORE, READ OUR STEP-BY-STEP GUIDE TO MAKING A DATA BREACH CLAIM.

hayes connor solicitors
,

2018 data hacks. What do you need to know?

Over the last 12 months, cyber-attacks and data breaches have rarely been out of the headlines. And, this is causing more and more of us to worry about what might happen if hackers manage to access our accounts and steal our valuable data.

The truth is, in a digital age, almost everything we do online needs a degree of trust. From buying a holiday to sharing on Facebook or checking our credit rating. But, all too often, the companies we are putting our faith in are letting us down. And, all too often we don’t know we are being hacked until it is too late.

Here are some of the most significant data leaks our expert data protection lawyers have been dealing with this year.

Ticketmaster

In June 2018, Ticketmaster UK identified malicious software on a customer support product hosted by an external third-party supplier.

Following the breach, Ticketmaster admitted that thousands of UK customer data had been accessed. This included a number of customers’ personal and financial details.

Find out more about the Ticketmaster data breach.

Equifax

The Equifax data breach might have started in 2017, but throughout 2018 we continued to be contacted by people worried that their data had been breached.

The second largest credit reference agency in the UK, Equifax is used by a wide range of companies. So, even people who were not Equifax customers discovered that the company held a wealth of information about them. Information which lenders use to assess whether to give credit cards, loans, mortgages etc.

As a result, up to 15 million British consumers were at risk of having their personal details stolen.

An ICO investigation, carried out in parallel with the Financial Conduct Authority, revealed multiple failures at the credit reference agency. And, as a result, Equifax has now been fined £500,000.

Find out more about the Equifax data breach.

British Airways

Initially, it was revealed that almost 400,000 British Airways customers had had their personal and bank/credit card details stolen in what was reported to be one of the most severe cyber-attacks in UK history.

Worryingly, it took over two weeks before the data breach was detected by the airline. In response, questions were asked as to whether poor systems have made this cyber-attack worse.

When investigating this case, a second data breach was also uncovered. In this instance, 77,000 people had their names, addresses, email addresses and detailed payment information taken. This included card numbers, expiry dates, and card verification value (CVV) numbers. And, a further 108,000 people had their personal details stolen.

Find out more about the BA data breach

Dixons Carphone

The Dixons (Carphone Warehouse) data breach took place in 2017 and resulted in 10 million customer records being accessed from Currys PC World and Dixons Travel stores. The details stolen by cyber criminals include names, addresses, phone numbers, dates of birth, and email addresses. All of which can be used by cybercriminals to commit further crimes. The hackers also got access to the records of 5.9 million payments cards (nearly all of which were protected by chip and pin).

Again, while this case took place in 2017, the ramifications have continued into this year.

Find out more about the Dixons Carphone data breach

Facebook

Earlier this year, a whistle-blower revealed how Facebook data was illegally harvested and used to influence the US Presidential election. The violation occurred after Cambridge Analytica targeted users with political messaging after obtaining data from the social media platform. Questions were raised over whether this data was also used to influence the outcome of the Brexit referendum.

To make matters worse for the social media giant, in addition to the Cambridge Analytica scandal, the platform was also hacked in September. In this instance, hackers stole digital login codes in what has been described as Facebook’s worst ever security breach.

Steps to follow after a data breach

With people everywhere now facing the threat of more regular security breaches, it’s vital that you know what to do should you become a victim of online data theft.

  • If you are worried that your banking details have been exposed, contact your bank immediately
  • Beware of fraudsters who attempt to gather personal information (phishing)
  • Report any suspected phasing attempts to the police and relevant authorities
  • Look out for any bills or emails showing goods or services you haven’t ordered, or any unfamiliar transactions on your account and alert your bank or card provider immediately if there is any suspicious activity
  • Keep an eye on your credit score for any unexpected dips. Call Credit, Experian and Equifax to ensure credit isn’t taken out in your name
  • Beware of any unsolicited communications that refer you to a web page asking for personal data
  • Register with a suitable fraud prevention service
  • Change your passwords.
  • If you are offered any form of compensation or free services from the organisation that put your data at risk it’s important to check the small print. Be careful that in accepting any offer you are not giving away your rights to pursue a separate data breach compensation claim at a later date
  • If you decide you want to make a data breach claim, read our handy step-by-step guide. If you have suffered damage or distress caused by an organisation breaching any part of the Data Protection Act, you have a right to claim compensation
  • Inform the Information Commissioner’s Office (ICO) about your concerns. While it does not award compensation, if the ICO believes that the organisation in question broke the law, you can use this information in court to help prove your claim
  • Contact Hayes Connor Solicitors. Our expert, online fraud and data protection solicitors will advise you on whether you have a valid claim and will be pleased to answer any questions you might have. If you are not sure whether your information has been misused or mishandled, we can find this out for you. Our initial assessment is always free. We’ll ensure that you are fully informed on this matter and will notify you about the investigation and your legal rights when making a claim.
data breach

Credit card details hacked in Vision Direct data breach

Cybercriminals have compromised the contact information and financial details of Vision Direct customers in a recent data hack.

Both personal and financial information has been put at risk, including full name, address, phone number, email address, and password details, as well as sensitive credit card numbers, expiry dates and CVV security codes. This information could be used to carry out financial fraud and data theft, so customers are understandably worried.

Earlier this week, the UK retailer informed its customers that their data was stolen in a five-day hack between 3rd and 8th of November. It is understood that a bogus Google Analytics script added to Vision Direct’s website let hackers breach the company’s security defences.

Should you be worried?

The breach affects customers who logged into their Vision Direct account or updated their personal details during the period in which the hack took place. At present, 16,300 customers are thought to be at risk.

In a letter to its customers, Vision Direct has admitted that this “information could be used to conduct fraudulent transactions”.

It continues: “Vision Direct has taken steps to prevent any further data theft, the website is working normally and we are working with the authorities to investigate how this theft occurred.”

Vision Direct will contact any customers who it believes have been affected by the data breach. The company has also asked all users to review their bank statements and change their passwords on the site as soon as possible.

Is Vision Direct responsible for the data breach?

Even where cybercriminals target a business, in the eyes of the law it is still responsible for the data it holds. And, if found to be (even partially) responsible for a data breach, under the new General Data Protection Regulation (GDPR), it could be liable for millions of pounds in fines and compensation.

In this case, questions have been raised over whether or not Vision Direct had been storing CVV codes as it is not permitted to keep verification codes after payments are authorised. If this is found to be the case, the regulator is likely to come down hard on the business.

If you have suffered damage or distress caused by an organisation breaching its data protection responsibilities, you also have a right to claim compensation.

At Hayes Connor Solicitors, we have considerable experience helping individuals whose data has been breached and would also recommend some additional steps to keep users safe.

This includes looking out for fraudsters who attempt to gather more personal information (phishing), informing the Information Commissioner’s Office (ICO) about your concerns and reporting any suspected phishing attempts to the police and relevant authorities.

You can also check websites such as Haveibeenpwned.com to see if your details have been compromised in a data breach.

personal data
,

High street stores and personal data: know your rights

Most of have been there. We’re in a shop, just about to pay for our purchases, or sort a refund, when the assistant asks for “a few details”; usually our full name, our home address, and our email. Even if we’re only buying a pair of shoes, or returning a scented candle, many of us will hand over this information without understanding why it is needed.

 For some, it’s about not making a scene. The assistant is friendly, and they appear to be in no doubt as to why they are asking for our personal information. Also, there’s often a growing queue of people who aren’t going to be happy with a customer kicking up a fuss and holding up the line. So, what should you do?

What should you do if a store asks for your personal information?

 Put simply; the shop doesn’t NEED your details. Even television retailers, who previously had to request these to send to TV Licensing when they sold or rented out equipment, no longer require this info from you.

And with stringent data protection laws now in place following the introduction of the General Data Protection Regulation (GDPR), you are entirely within your rights not to hand this over.

 Do shops need personal data for a refund?

 If you’ve challenged why the shop needs this information, you might have been met with a vague response; “to process the return”, “for our records”…that sort of thing. However, we all have a statutory right to return faulty goods and, should you wish to change your mind about a purchase you simply need to do two things:

  • Keep hold of the receipt
  • Check out the shop’s returns policy before you buy.

Unless the return policy states explicitly that you have to hand over this information (and most of them don’t), then they cannot force you to. If the policy does state that it needs your personal information, you should still query why with a manager as this is not a legal obligation.

 Why do retailers want this information?

 Stores use your details for different purposes, most often for security, for marketing, and to improve the customer experience. You might like the shop retaining information about your shopping habits to help improve their service to you. For example, if you buy a particular shade of lipstick but can never remember the name, with access to the right info the shop assistant can find out that your preferred shade is ‘Frosted Pink.’ Also, most of us like it when we are offered discounts on our favourite buys.

 That’s fine. It’s your choice. But even if you are happy with this, to protect your sensitive information, you should still care about how your personal details are stored.

What are retailers allowed to do with your information?

Any personal data we provide (e.g. email addresses collected at the point of sale) is protected by UK data protection regulations. This means that it must be “collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.”

For example, if an email address is given so that you can receive an e-receipt, then your data can only be used for this specific purpose. There is no issue with a shop offering an e-receipt, but if your email address is then used to send you marketing emails without your consent they might also be breaching electronic marketing rules. You also do not have to give your email details to a retailer, and you can ask to receive your receipt in the normal way.

If a shop does want your data to market to you, then they must make it clear that this is why they are asking for your information, and you have to give your consent before they can do this.

How is your data protected?

 With more and more shops using computers to store and process personal information, The Data Protection Act (the UK’s interpretation of the GDPR) sets out how it can be used; and how it can’t. The basic things you need to know is that:

  • Your personal data should be processed fairly and lawfully
  • It must be obtained only for a specified reason and can’t be handled in a way that is incompatible with that purpose
  • The information held must be adequate, relevant and not excessive when compared with the purpose for which it is to be used
  • It must be accurate and, where necessary, kept up to date
  • It must not be kept for longer than is necessary for the intended purpose
  • It must be processed in accordance with the Data Protection Act. This means that it must be kept safe and secure, and that appropriate measures will be taken against unauthorised or unlawful processing of this information, as well as against accidental loss, destruction, or damage. So, businesses must keep the information backed up and away from any unauthorised access
  • No company can sell or give away your information without your explicit consent.

 You can find out more about these principles on the Information Commissioner’s Office (ICO) website.

 What should you do if asked to hand over your details?

 In most cases, we trust these retailers. Why wouldn’t we? They are high street shops, with familiar names, big shiny signs above their windows and friendly authoritative staff. So, it can be easy to assume that they wouldn’t ask us for our address if they weren’t allowed to do so. We also trust them to hold our information safely once given.

 However, in 2018, high street chemist Superdrug was held to ransom by hackers. The cybercriminals contacted Superdrug claiming to have accessed the details of 20,000 customers.

The compromised data included names, addresses, dates of birth, phone numbers, and point balances. And, while no bank or payment card details were believed to have been accessed, the information stolen is already enough to cause severe distress to those affected. And this is just one example of a high street retailer being hit by a data breach.

Today’s cybercriminals don’t just care about our financial details. They can also cause havoc with our personally identifiable information. In fact, with enough data, cybercriminals can apply for credit in your name, set up fraudulent bank accounts and access your existing accounts.

So, should you hand over your details? Well, as with most things, you have a choice. A choice to ask questions, and a choice to exercise your own free will based on the answers that are provided to you.

While we have previously been content to hand out our personal information, with a huge jump in cyber fraud, it’s perhaps no wonder that consumer confidence is now lacking, and that data breach claims are on the rise.

Can you make a data breach compensation claim?

 When a breach happens, it’s vital that the Information Commissioners Office (ICO) investigates. If the company is found responsible, the ICO will then issue a fine.

However, such fines are little compensation for victims who have suffered financial loss and/or stress due to an organisation’s negligence. So, while the ICO does not award data breach compensation, our data breach solicitors can help you with that.

At Hayes Connor Solicitors, we’ve been helping people to get the compensation they deserve for over 50 years, so we know what it takes to make a successful data breach claim.

Data breaches often have severe consequences for those affected, and you could be entitled to thousands of pounds in compensation depending on your circumstances. And, because we offer no-win, no-fee funding arrangements, you have nothing to lose.

subject access request

How to make a subject access request following a data breach

Under the UK’s data protection legislation, you have the right to find out if an organisation is using or storing your personal data. To exercise this right, all you have to do is ask for a copy of this data. This is called making a subject access request (SAR).

You can also ask if your data is being shared with anyone else (and if so, why and how), how long the company plans to store your data, and the reasons for this decision, and information on where your data came from.

Do you have to pay to make a subject access request?

A copy of your personal data should be provided free, although if you ask for extra copies, or if you ask for information that is ‘manifestly unfounded or excessive’, the organisation might charge a reasonable fee for administrative costs.

When can you make a subject access request?

You can make a subject access request at any time. For example, you can make a SAR if you want to find out if information is being held about you and how it is being used. In addition, at Hayes Connor Solicitors, many of our clients make SARs to start the compensation claim process following a data breach.

How do you make a subject access request?

If you decide that you want to make a SAR, here are the steps you should take:

  1. Identify where to send your request. Under the GDPR this information should be available on an organisation’s website (check the privacy policy usually found in the footer)
  2. Decide what data you want access to. Do you want everything a company holds about you, or just a particular piece of information? It could take longer for an organisation to supply everything they have about you, so if you only need certain data and you want this quickly, it makes sense to be specific. For example, you could just ask for a copy of any emails between you and the company between particular dates
  3. Make your request directly to the organisation, stating clearly what you want. You can make a SAR in writing, in person or over the phone. At Hayes Connor Solicitors we always recommend that our clients put their requests in writing as this provides a clear evidence trail if we need this at a later date
  4. When making a SAR, you should also include your name and contact details as well as any account or reference numbers
  5. You should also specify what format you want the data in. Most companies will do this electronically, but if you need it in another format, you can ask if this is possible
  6. Keep a copy of your request as well as any proof of postage or delivery.

How long does an organisation have to respond to a subject access request?

Data protection law requires organisations to respond to a request for data within one calendar month. However, they might need extra time to consider your request and, if so, can take an additional two months to do this. The organisation must let you know within one month if it needs more time and why. If the requested information is not provided in the timeframe you can raise a complaint with the Information Commissioner’s Office.

Can an organisation refuse ae subject access request?

While you can make more than one SAR, the organisation can refuse a request if they believe it to be ‘manifestly unfounded or excessive’.

Depending on the circumstances, they may also refuse a SAR if your data includes information about another individual. Again, if you think your request has been rejected unjustly, you can raise a complaint with the organisation in question, and if you remain dissatisfied, the Information Commissioner’s Office.

At Hayes Connor Solicitors we are committed to upholding the data protection rights of our clients. With over 50 years’ experience helping our clients secure the justice they deserve, our solicitors work tirelessly to ensure the best possible outcome for you. Both in terms of damages achieved and service delivered.

,

What should you do immediately after a data breach?

In today’s digital world, your personal data is a valuable commodity. However, all too often negligent business processes, human error and cybercrime mean this sensitive data isn’t as protected as it should be. With warnings that consumer trust is “becoming more fragile” following a spate of high-profile data breaches, if you have been the victim of a breach or cyber-attack it is important that you know how to react.

Steps to follow after a data breach

If you have suffered damage or distress caused by an organisation breaching any part of the Data Protection Act, you have a right to claim compensation. You should also:

  • Inform the Information Commissioner’s Office (ICO) about your concerns. While it does not award compensation, if the ICO believes that the organisation in question broke the law, you can use this information in court to help prove your claim
  • Read our handy step-by-step guide to making a data breach claim
  • If you are worried that your banking details have been exposed, contact your bank immediately
  • Beware of fraudsters who attempt to gather personal information (phishing)
  • Report any suspected phishing attempts to the police and relevant authorities
  • Look out for any bills or emails showing goods or services you haven’t ordered, or any unfamiliar transactions on your account and alert your bank or card provider immediately if there is any suspicious activity
  • Keep an eye on your credit score for any unexpected dips. Call Credit, Experian and Equifax to ensure credit isn’t taken out in your name
  • Beware of any unsolicited communications that refer you to a web page asking for personal data
  • Register with a suitable fraud prevention service
  • Change your passwords.
  • If you are offered any form of compensation or free services from the organisation that put your data at risk it’s important to check the small print. Be careful that in accepting any offer you are not giving away your rights to pursue a separate data breach compensation claim at a later date
  • Contact Hayes Connor Solicitors. Our expert, online fraud and data protection solicitors will advise you on whether you have a valid claim and will be pleased to answer any questions you might have. If you are not sure whether your information has been misused or mishandled, we can find this out for you. Our initial assessment is always free. We’ll ensure that you are fully informed on this matter and will notify you about the investigation and your legal rights when making a claim.

Can you claim compensation if you didn’t lose any money?

In short, yes. Many people suffer anguish, anxiety and stress after a data breach and this can have a significant impact on you mentally and physically. Effects can include a lack of sleep, feeling ill, unsettled or confused. Stress can also affect your friends, your family and your job.

Organisations have a duty to protect your sensitive data. And letting other people access this is a complete failure of this responsibility. So, why shouldn’t you seek compensation for this inability to look after your information correctly if it has caused you distress?

If you want to find out more about claiming for a data breach you can contact us here

hayes connor solicitors

Claiming compensation for distress following a data breach. Know your rights.

At Hayes Connor Solicitors, we are committed to making sure that people who have had their personal data stolen or otherwise put at risk know their rights. This is the only way to make sure that companies are held to account for their failure to protect your information.

What the law says

The General Data Protection Regulation (GDPR) places strict obligations on businesses to keep our data safe. And if you have suffered damage or distress caused by an organisation breaching any part of the Data Protection Act (the UK’s interpretation of the GDPR), you have a right to claim compensation.

But did you know that you can also claim for GDPR distress as well as financial losses? In the UK, you can make a compensation claim if you have struggled emotionally following a data breach, even if you have not experienced any financial loss.

When making a compensation award, the court will look at the specific circumstances of your case. This includes things like the sensitivity of the data compromised and the nature of the disclosure. However, in order to be entitled to compensation for GDPR distress you must show that you have suffered emotionally because of the breach.

A personal data breach is a 21st-century version of being burgled. If a criminal came into your home and stole your private letters you would be distressed. So why should you feel any less upset at having your online data taken; particularly when these companies gave the burglar the keys?

The emotional impact of data breaches

Some people would have us believe that claiming for GDPR distress is an overreaction. That your physiological suffering and anguish doesn’t matter. You might hear friends and family saying that, while it is acceptable to claim compensation for any financial losses, you should put up with any anxiety caused by having your information stolen.

But according to Victim Support: “The effects of crime can also last for a long time, and it doesn’t depend on how ‘serious’ the crime was. Some people cope really well with the most horrific crimes while others can be very distressed by a more minor incident”.

The sheer scale of the information we share online is enough to leave victims open to the threat of fraud. For example, with enough information, cybercriminals can steal your identity, apply for credit in your name, set up fraudulent bank accounts and access your existing accounts. So we should all be very worried about what could happen if our data gets into the wrong hands.

What’s more, being the victim of a crime can have a substantial impact on you mentally and physically. For some people, the effects can include a lack of sleep, feeling ill, unsettled or confused. Stress can also affect your friends, your family and your job. So being told to “get over it” isn’t helpful.

Crucially, the law understands the damage that can be caused by worry and upset. So you are 100% within your rights to make a compensation claim.

Claiming for GDPR distress following a data breach

At Hayes Connor Solicitors, we are committed to helping those affected by data breaches and cybercrime. And, we believe that the best way to make big companies pay for their failures is to use an expert lawyer to make a data breach compensation claim.

In addition, we also work with, and refer our clients to, other organisations and partners such as Victim Support. The leading independent victim’s charity in England and Wales for people affected by crime and traumatic incidents, last year Victim Support offered help to nearly a million victims of crime across the UK.

If you need assistance after a data breach, there are many resources on the Victim Support website to help you cope.

Don’t let them get away with it!

Something has to be done to make companies accountable for not looking after our information correctly. Claiming compensation isn’t just in your best interests, it could be the only way to ensure that businesses everywhere implement more secure processes.

 

data protection breach
,

My personal information has been lost after a data breach, what are my rights?

With the number of data breaches and cyber-attacks on the rise, it is essential that you understand your rights. So what do you need to know?

What type of information do organisations hold about me?

Modern organisations hold a tremendous amount of information about us. This could include data such as:

  • your name
  • your address
  • your date of birth
  • your email address
  • your telephone numbers
  • your credit card details
  • your bank details
  • your password(s)
  • your medical records
  • your religion
  • your political allegiances
  • and more.

 Of course, it’s easy to figure out what could go wrong if our financial information gets into the wrong hands. But it’s more complicated than that.

The UK’s data protection laws safeguard your personally identifiable information (PII). PII includes any data that can be used to identify a specific individual; either on its own, or in conjunction with other information an organisation has about us.

If PII gets into the wrong hands, it can be used to undertake identity fraud. For example, with enough information, cybercriminals can apply for credit in your name, set up fraudulent bank accounts and access your existing accounts.

 What is a data breach?

 A personal data breach occurs when personal information, protected under the law, is destroyed, lost, altered, disclosed or accessed due to a security incident.

It doesn’t matter if this happens accidentally or deliberately. If the confidentiality, integrity or availability of your personal data has been put at risk, then a data breach has occurred.

 If you have suffered damage or distress caused by an organisation breaching any part of the Data Protection Act, you have a right to claim compensation. The Data Protection Act is the UK’s interpretation of the General Data Protection Regulation (GDPR).

Some of the most common types of data protection breaches include:

  • Where your data has been inadvertently lost, hacked or leaked
  • Where your identity has been stolen to obtain credit cards fraudulently
  • Where your personal data has been sent to someone else without your express permission
  • Where your personal information has been misused or mishandled
  • Where an organisation failed to maintain up-to-date, accurate information about you and this caused you damage.

What is the difference between a data breach and a data hack?

The terms “breach” and “hack” are often used interchangeably. But there are some differences.

  • A data breach refers to any situation where data has been put at risk. A data breach can occur because of hackers and other cybercriminals, or by human error, negligence and poor security processes
  • A data hack is caused by people with malicious intent who break into a company’s systems to steal information.

Hackers do not cause the majority of data infringements, but in each of these instances, data can be exposed and put at risk. As such, identity theft often occurs after a data breach as well as a data hack.

How does an organisation have to respond to a data breach?

There are strict procedures that an organisation must follow if it experiences a data breach that could put your personal data (and therefore you) at risk. This includes informing the regulators that a data violation has occurred and letting you know without undue delay.

Should this happen, you should be told:

  • What has happened
  • The likely consequences
  • What they are doing to respond to the breach and minimise the risk to you
  • Who you can contact for more information.

What to do following a data breach

 If you have been told your data is at risk following a data breach, you should:

  • Contact your bank or card provider if your financial details have been compromised. If you’re not happy with the way your bank deals with your complaint, you can refer it to the Financial Ombudsman Service (FOS)
  • Beware of fraudsters who attempt to gather personal information (phishing)
  • Report any suspected phishing attempts to the police and relevant authorities
  • Look out for any bills or emails showing goods or services you haven’t ordered, or any unfamiliar transactions on your account and alert your bank or card provider immediately if there is any suspicious activity
  • Keep an eye on your credit score for any unexpected dips. Call Credit, Experian and Equifax to ensure credit isn’t taken out in your name
  • Beware of any unsolicited communications that refer you to a web page asking for personal data
  • Register with a suitable fraud prevention service
  • Change your passwords.

If you find that you have become the victim of cybercriminals following a data breach, you should contact Action Fraud as soon as possible.

Make a compensation claim for damage and distress

To claim compensation, you must be able to prove that you suffered as a result of the breach. This includes financial and medical harm, as well as anguish and anxiety. In many cases, a violation will not cause damage but will cause distress.

While some people would have us believe that claiming for distress is an overreaction, the law doesn’t agree with them.

Many people suffer anguish, anxiety and stress after a data breach and this can have a significant impact on you mentally and physically. Effects can include a lack of sleep, feeling ill, unsettled or confused. Stress can also affect your friends, your family and your job. So being told to just “get over it” isn’t helpful.

Organisations have a duty to protect your sensitive data. And letting other people access our bank accounts is a complete failure of this responsibility. So, why shouldn’t you seek compensation for this inability to look after your information correctly if it has caused you distress?

Until recently, a person who suffered damage might have had their compensation increased to take into account any associated distress, but in most cases, compensation would not have been awarded for distress alone. However, a recent ruling has paved the way for those affected by data breaches to claim damages for distress, even if they have not suffered any financial loss.

To start a compensation claim

  1. Inform the Information Commissioner’s Office (ICO) about your concerns. While it does not award compensation, if the ICO believes that the organisation in question broke the law, you can use this information in court to help prove your claim
  2. Read our handy step-by-step guide to making a data breach claim
  3. If you are offered any form of compensation or free services for not being able to access your funds it’s important to check the small print. Be careful that in accepting any offer you are not giving away your rights to pursue a separate data breach compensation claim at a later date

Contact Hayes Connor Solicitors ASAP. We’ll ensure that you are fully informed on this matter and will notify you about the investigation and your legal rights when making a claim